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(TS//SI//REL) " Fourth party collection " refers to passively or actively 
obtaining data from some other actor's CNE activity against a target. Has 
there ever been an instance of NSA obtaining information from Actor One 
exploiting Actor Two's CNE activity against a target that NSA, Actor One, 
and Actor Two all care about? 
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(TS//SI//REL) Yes. There was a project that I was working last year with 
regard to the South Korean CNE program. While we aren't super interested 
in SK (things changed a bit when they started targeting us a bit more), we 
were interested in North Korea and SK puts a lot of resources against them. 
At that point, our access to NK was next to nothing but we were able to make 
some inroads to the SK CNE program. We found a few instances where there 
were NK officials with SK implants on their boxes, so we got on the exfil 
points, and sucked back the data. Thats fourth party. (TS//SI//REL) However, 
some of the individuals that SK was targeting were also part of the NK CNE 
program. So I guess that would be the fifth party collect you were talking 
about. But once that started happening, we ramped up efforts to target NK 
ourselves (as you dont want to rely on an untrusted actor to do your work for 
you). But some of the work that was done there was able to help us gain 
access. (TS//SI//REL) I know of another instance (I will be more vague 
because I believe there are more compartments involved and parts are 
probably NF) where there was an actor we were going against. We realized 
there was another actor that was also going against them and having great 
success because of a 0 day they wrote. We got the 0 day out of passive and 
were able to re-purpose it. Big win. (TS//SI//REL) But they were all still 
referred to as fourth party, 
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CLASSIFICATION : UNCLASSIFIED 

C: UK TOP SECRET STRAP1 COMINT AUSCANUKUSNZ (TS//SI//REL//) '4th 
Party' was, of course, a COMINT (and particularly a cryppie) term long 
before it was a CNE one (or CNE even existed). In a COMINT context, ISTR 
meeting a '5th Party' scenario from '70s: GCHQ station collected cipher on 
nation A's internal security comms. Broken cipher revealed collect (including 
cipher texts) by A's SIGINT against neighbouring nation B's internal security 
comms (so that was '4th Party'). Some of B's texts so obtained revealed intel 
derived from B's domestic intercept targets, so I guess that was '5th Party' .. 
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